How to update PVE via POM packages without setting up a full offline mirror site?

[pulipulichen]

Hi everyone, I'm setting up a completely disconnected darksite environment. For security reasons, I don't want to set up any kind of offline mirror server within the internal network. To be honest, I really want to avoid starting even a temporary HTTP server for updates because I need to keep the environment as restricted as possible.

I would much rather just host the necessary package files on a specific internal server we already have, rather than using POM's built-in hosting feature. I've looked into Proxmox Offline Mirror (POM), but most of the official documentation seems to focus on setting up a persistent mirror host for other nodes to connect to.

Is there a way to bundle the packages that POM has already downloaded, move them to our existing internal site, or perhaps download packages within the LAN or even use an ISO, and then have PVE read those files from there to perform the update?

 

[proxuser77]

For security reasons, I don't want to set up any kind of offline mirror server within the internal network. To be honest, I really want to avoid starting even a temporary HTTP server for updates because I need to keep the environment as restricted as possible.

Why is that an issue? I mean you could put the POM in a separte network/DMZ, and only allow the PVE hosts access to it. But maybe the "Manual setup" will get you closer to what you want to achieve: https://pom.proxmox.com/offline-media.html#manual-setup

Is there a way to bundle the packages that POM has already downloaded, move them to our existing internal site, or perhaps download packages within the LAN or even use an ISO, and then have PVE read those files from there to perform the update?

The hole "Offline Media" chapter "https://pom.proxmox.com/offline-media.html#offline-media" might be relevant then. To me, it sounds like it essentially does what you want, but maybe not exactly in the way you’re imagining it. At the end of the day, though, apt still needs to be able to fetch the packages somehow in order to install or update them. You can’t really bypass the package manager itself, if that’s what you had in mind.